BIT-parse-2026-116161

    Dashboard / Vulnerabilities / BIT-parse-2026-116161

    BIT-parse-2026-116161

    Published: 30 Oct 2026Last Modified: 30 Oct 2026

    Summary: Parse Server 9.0.0 before 9.10.5 LiveQuery Information Disclosure via $or Subscriptions

    Details: Parse Server before 8.6.103 and 9.0.0 before 9.10.5 contains an information disclosure vulnerability in LiveQuery. Its subscription hash omits constraints next to a $or operator, including the _Session owner filter and beforeSubscribe constraints, so distinct subscriptions are grouped together. Authenticated clients subscribing with $or queries can receive other users' events, including session tokens usable for impersonation.

    References: https://github.com/parse-community/parse-server/security/advisories/GHSA-349r-988w-x3jp, https://nvd.nist.gov/vuln/detail/CVE-2026-116161, https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.5-alpha.4-livequery-information-disclosure-via-or-subscriptions

    Affected packages

    Package

    Name: parse

    Purl: pkg:bitnami/parse

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -8.6.103

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    BIT-parse-2026-116161 | CVE-DB